Lucene search
+L

8301 matches found

Redos
Redos
added 2026/05/25 12:0 a.m.37 views

ROS-20260525-73-0002

Vulnerability in awscli related to the use of an invalid referenced name. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

5.8AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/05/24 6:54 p.m.17 views

Malicious code in shiroai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cde2f64fd59e62071433f92eab83a4817f0b306ff1735aa8c31ae31dcaf9830 shiroai is advertised as a CLI where the installer authenticates with their own API key via shiroai login . In practice, cli.js ignores any...

5.9AI score
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/05/24 1:45 a.m.16 views

Malicious code in env-loader-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1749501a0825ad4a98638bbab4bd2bd9550436adcb9bb7781b6552735f7f3eb0 The package advertises itself as a benign.env/JSON/YAML loader but its top-level init.py imports a hidden core module that, on every import envloader...

5.9AI score
SaveExploits0References6
OPENSUSE Linux
OPENSUSE Linux
added 2026/05/24 12:0 a.m.13 views

jfrog-cli-2.104.1-1.1 on GA media (moderate)

jfrog-cli-2.104.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:10844-1 Rating: moderate Cross-References: CVE-2025-11579 CVSS scores: CVE-2025-11579 SUSE : 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-11579 SUSE : 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA...

4.8CVSS7.3AI score0.00349EPSS
SaveExploits1
Snyk
Snyk
added 2026/05/23 9:0 p.m.21 views

Malicious Package

Overview env-loader-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package was linked to a supply chain attack and contained code designed to steal developer secrets, crypto wallets, SSH keys, and cloud...

9.8CVSS5.8AI score
SaveExploits0References2
OSV
OSV
added 2026/05/23 12:0 a.m.17 views

OPENSUSE-SU-2026:10844-1 jfrog-cli-2.104.1-1.1 on GA media

These are all security issues fixed in the jfrog-cli-2.104.1-1.1 package on the GA media of openSUSE Tumbleweed...

6.5CVSS5.8AI score0.00349EPSS
SaveExploits1References1
Chainguard
Chainguard
added 2026/05/22 7:17 p.m.26 views

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: syft-fips, docker-fips, neuvector, neuvector-scanner-fips, trivy-fips, osv-scanner, spegel, xeol-fips, skaffold-fips, cloudbeat-fips, jfrog-cli, trivy-operator-fips, chainctl-fips, rancher, buildkitd, upwind-agent, cluster-api-helm-controller-fips, headlamp,...

7.8CVSS7.3AI score0.00221EPSS
SaveExploits1
NVD
NVD
added 2026/05/22 7:17 p.m.26 views

CVE-2026-6406

The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation ECI restrictions in Docker Desktop. When ECI is enabled, Docker socket mounts from containers are denied unless explicitly allowed via the admin-settings configuration. However, the --use-api-socket flag adds the Docker...

8.8CVSS0.00211EPSS
SaveExploits0References2
NVD
NVD
added 2026/05/22 5:16 p.m.17 views

CVE-2026-9255

Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary tools, including shell commands, without user approval by crafting content that is piped to kiro-cli via stdin. We recommend you to upgrade to kiro-cli version...

8.4CVSS0.00119EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/22 4:42 p.m.13 views

Malicious Package

Overview polymarket-trading-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS5.8AI score
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/05/22 4:38 p.m.13 views

CVE-2026-9255 Tool Execution Without Authorization via Piped Stdin in Kiro CLI

Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary tools, including shell commands, without user approval by crafting content that is piped to kiro-cli via stdin. We recommend you to upgrade to kiro-cli version...

8.4CVSS6.1AI score0.00119EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/05/22 4:38 p.m.9 views

CVE-2026-9255

Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary tools, including shell commands, without user approval by crafting content that is piped to kiro-cli via stdin. We recommend you to upgrade to kiro-cli version...

8.4CVSS6.1AI score0.00119EPSS
SaveExploits0References3
CVE
CVE
added 2026/05/22 4:38 p.m.40 views

CVE-2026-9255

Kiro CLI vulnerability CVE-2026-9255 affects kiro-cli prior to version 1.28.0. Missing input source validation in the tool authorization prompt allows a local attacker to run arbitrary tools, including shell commands, by piping crafted content to kiro-cli via stdin. This is a local-attack risk wi...

8.4CVSS6.1AI score0.00119EPSS
SaveExploits0References2Affected Software1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/05/22 1:21 p.m.16 views

Malicious code in share-anything-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 290f9dadaf589349dd8a7c641450aca713a6ead63b2ba685c15e4e6a37ab3b07 The package's package.json declares a postinstall lifecycle hook "postinstall": "node install.js" that runs install.js automatically on npm install...

5.8AI score
SaveExploits0References1
OSV
OSV
added 2026/05/22 1:21 p.m.13 views

MAL-2026-4668 Malicious code in share-anything-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 290f9dadaf589349dd8a7c641450aca713a6ead63b2ba685c15e4e6a37ab3b07 The package's package.json declares a postinstall lifecycle hook "postinstall": "node install.js" that runs install.js automatically on npm install...

5.8AI score
SaveExploits0References1
OSV
OSV
added 2026/05/22 11:16 a.m.14 views

MAL-2026-4533 Malicious code in codebuff-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdf777f03e4dc44a9956401136a42f099638025ef7d2197dec630525ad26727d The package name codebuff-cli impersonates the legitimate codebuff npm package; the README is copy-pasted from the official CodebuffAI project it eve...

5.9AI score
SaveExploits0References26
OSV
OSV
added 2026/05/22 10:25 a.m.15 views

MAL-2026-4563 Malicious code in finkrouter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75cee0798d304ff9f0532df845511df6560314b8808664c15b3c3aa18f1953b5 The package's CLI shipped as cli.obf.js, the javascript-obfuscator output with RC4 string-array encoding and control-flow flattening per package.json...

6AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/05/22 10:25 a.m.17 views

Malicious code in finkrouter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75cee0798d304ff9f0532df845511df6560314b8808664c15b3c3aa18f1953b5 The package's CLI shipped as cli.obf.js, the javascript-obfuscator output with RC4 string-array encoding and control-flow flattening per package.json...

5.9AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/05/22 6:34 a.m.15 views

Malicious code in lynx-keeper-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cebbf0e6cc5a35eea6e6869d295d072526b6ff7d566c49bc80f15952138cf88 lynx-keeper-cli ships a heavily obfuscated payload in dist/index.js that runs at require time. After a CI-evasion gate that aborts when...

5.8AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/05/22 6:25 a.m.13 views

Malicious code in bingocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78f3d873e7c4d16629263bb242a2636f18747d5dd096b614fb3cf43a56d2dc8e The package declares bin.claude pointing at bin/claude-win.cjs and bin/claude on Linux/macOS. After npm i -g bingocode, the claude command on PATH is...

5.5AI score
SaveExploits0References2
Rows per page
Query Builder